Description

The original part of Sleuth Kit is a C library and collection of
command line file and volume system forensic
analysis tools. The file system tools
allow you to examine file systems of a suspect computer in a
non-intrusive fashion. Because the tools do not rely on the operating
system to process the file systems, deleted and hidden content is
shown. It runs on Windows and Unix platforms.

The volume system (media management) tools allow you to examine the layout of
disks and other media. The Sleuth Kit supports DOS partitions, BSD
partitions (disk labels), Mac partitions, Sun slices (Volume Table
of Contents), and GPT disks. With these tools, you can identify
where partitions are located and extract them so that they can be
analyzed with file system analysis tools.

When performing a complete analysis of a system, we all know
that command line tools can become tedious. Autopsy is a
graphical interface to the tools in The Sleuth Kit, which allows
you to more easily conduct an investigation. Autopsy provides case
management, image integrity, keyword searching, and other automated
operations.

A complete analysis also requires more than just file and volume system
analysis. Howerever, a single tool can't provide support for all file types and analysis techniques. The TSK Framework allows tool so easily incorporate file analysis modules that were written by other developers. If you are developing a tool, consider incorporating in the framework or developing your analysis technique as a module into the framework.

Input Data

Supports the NTFS, FAT, ExFAT, UFS 1, UFS 2, EXT2FS, EXT3FS, Ext4, HFS, ISO 9660, and YAFFS2 file systems
(even when the host operating system does not or has a different
endian ordering).

Tools can be run on a live Windows or UNIX system during Incident Response.
These tools will show files that have been "hidden" by rootkits and
will not modify the A-Time of files that are viewed. (Sleuth Kit
Informer #13)

Organize files based on their type (for example all
executables, jpegs, and documents are separated). Pages of
thumbnails can be made of graphic images for quick analysis.
(Sleuth Kit Informer #3, #4, #5)

The Sleuth Kit is written in C and Perl and uses some code and design
from The Coroner's Toolkit (TCT). The Sleuth Kit has been tested on: